China-linked CopperDragon spies hit telecoms, governments and militaries in Latin America, Asia and Europe; hacked websites show a fake Chrome certificate error that installs the SquadC backdoor (Check Point)

Check Point Research (10 Nov 2026) links three spy campaigns, which it tracked for a year, to CopperDragon. CopperDragon appears to build and supply the Sparrow malware framework (SparrowDoor and relatives) for China-nexus groups such as FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. Several dozen high-profile organizations were hit. SilentDelivery (since early 2026, Europe and Asia; Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia named): attackers hack government, shipping and IT/research websites that their targets visit. Injected JavaScript swaps the page for a fake Google Chrome SSL certificate warning in the site's language, with an 'Install certificate' / 'Certificate Fix' button. The button downloads an MSI from attacker-controlled S3 buckets that installs the new SquadC Windows backdoor or a SparrowDoor variant. SquadC is also sent by spear-phishing as an RAR with a fake .docx LNK. OceanGate (mainly Asia): attackers break into internet-facing Linux systems, then move into Windows using a SparrowDoor variant and Linux/Windows post-exploitation tools. DarkWire (Latin American telecoms and governments): uses the CopperDoor and CopperDNS backdoors. Check Point also reports Linux variants and passive backdoors, and a link to the Melofee backdoor. Which internet-facing products OceanGate exploited, and the full indicator list, are not in the part of the report we could read (unknown).